Intel64 and IA32 Instruction Encoding

Preface

• Date: 07/11/2023
• Reference: Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes - Volume 2 - Chapter 2 Instruction Format
• Link: Intel® 64 and IA-32 Architectures Software Developer Manuals

Overview

The Intel 64 and IA-32 architectures instruction encodings are subsets of the format shown in below.

Instructions consist of optional instruction prefixes (in any order), primary opcode bytes (up to three bytes), an addressing-form specifier (if required)consisting of the ModR/M byte and sometimes the SIB (Scale-Index-Base) byte, a displacement (if required), and an immediate data field (if required).

Prefixes

Instruction prefixes are divided into four groups, each with a set of allowable prefix codes. For each instruction, it is only useful to include up to one prefix code from each of the four groups (Groups 1, 2, 3, 4). Groups 1 through 4 may be placed in any order relative to each other.

• Group 1
  • Lock and repeat prefixes:
    • LOCK prefix is encoded using F0H.
    • REPNE/REPNZ prefix is encoded using F2H. Repeat-Not-Zero prefix applies only to string and input/output instructions. (F2H is also used as a mandatory prefix for some instructions.)
    • REP or REPE/REPZ is encoded using F3H. The repeat prefix applies only to string and input/output instructions. (F3H is also used as a mandatory prefix for some instructions.)
  • BND prefix is encoded using F2H if the following conditions are true:
    • CPUID.(EAX=07H, ECX=0):EBX.MPX[bit 14] is set.
    • BNDCFGU.EN and/or IA32_BNDCFGS.EN is set.
    • When the F2 prefix precedes a near CALL, a near RET, a near JMP, a short Jcc, or a near Jcc instruction (see Appendix E, “Intel® Memory Protection Extensions,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1).
• Group 2
  • Segment override prefixes:
    • 2EH—CS segment override (use with any branch instruction is reserved).
    • 36H—SS segment override prefix (use with any branch instruction is reserved).
    • 3EH—DS segment override prefix (use with any branch instruction is reserved).
    • 26H—ES segment override prefix (use with any branch instruction is reserved).
    • 64H—FS segment override prefix (use with any branch instruction is reserved).
    • 65H—GS segment override prefix (use with any branch instruction is reserved).
  • Branch hints:
    • 2EH—Branch not taken (used only with Jcc instructions).
    • 3EH—Branch taken (used only with Jcc instructions).
• Group 3
  • Operand-size override prefix is encoded using 66H (66H is also used as a mandatory prefix for some instructions).
• Group 4
  • 67H—Address-size override prefix.

Opcodes

A primary opcode can be 1, 2, or 3 bytes in length. An additional 3-bit opcode field is sometimes encoded in the ModR/M byte. Smaller fields can be defined within the primary opcode. Such fields define the direction of operation, size of displacements, register encoding, condition codes, or sign extension. Encoding fields used by an opcode vary depending on the class of operation.

Two-byte opcode formats for general-purpose and SIMD instructions consist of one of the following:

• An escape opcode byte 0FH as the primary opcode and a second opcode byte.
• A mandatory prefix (66H, F2H, or F3H), an escape opcode byte, and a second opcode byte (same as previous bullet).

ModR/M and SIB Bytes

Many instructions that refer to an operand in memory have an addressing-form specifier byte (called the ModR/M byte) following the primary opcode. The ModR/M byte contains three fields of information:

• The mod field combines with the r/m field to form 32 possible values: eight registers and 24 addressing modes.
• The reg/opcode field specifies either a register number or three more bits of opcode information. The purpose of the reg/opcode field is specified in the primary opcode.

Certain encodings of the ModR/M byte require a second addressing byte (the SIB byte). The base-plus-index and scale-plus-index forms of 32-bit addressing require the SIB byte. The SIB byte includes the following fields:

• The scale field specifies the scale factor.
• The index field specifies the register number of the index register.
• The base field specifies the register number of the base register.

Displacement and Immediate Bytes

Some addressing forms include a displacement immediately following the ModR/M byte (or the SIB byte if one is present). If a displacement is required, it can be 1, 2, or 4 bytes.

If an instruction specifies an immediate operand, the operand always follows any displacement bytes. An immediate operand can be 1, 2 or 4 bytes.

A Cat Passed by Here

    /\_____/\
   /  o   o  \
  ( ==  ^  == )
   )         (
  (           )
 ( (  )   (  ) )
(__(__)___(__)__)

OK LET'S GO ONE STEP DEEPER

Yet Another Preface

• Date: 08/11/2023
• Reference: Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes - Volume 2 - Appendix B Instruction Formats and Encodings
• Link: Intel® 64 and IA-32 Architectures Software Developer Manuals

Overview

All Intel Architecture instructions are encoded using subsets of the general machine instruction format shown below. Each instruction consists of:

• an opcode
• a register and/or address mode specifier consisting of the ModR/M byte and sometimes the scale-index-base (SIB) byte (if required)
• a displacement and an immediate data field (if required)

Note:

• The Reg Field may be used as an opcode extension field (TTT) and as a way to encode diagnostic registers (eee).

Legacy Prefixes

The legacy prefixes include 66H, 67H, F2H, and F3H. They are optional, except when F2H, F3H, and 66H are used in instruction extensions. Legacy prefixes must be placed before REX prefixes.

REX Prefixes

REX prefixes are a set of 16 opcodes that span one row of the opcode map and occupy entries 40H to 4FH. These opcodes represent valid instructions (INC or DEC) in IA-32 operating modes and in compatibility mode. In 64-bit mode, the same opcodes represent the instruction prefix REX and are not treated as individual instructions.

Opcode Fields

The primary opcode for an instruction is encoded in one to three bytes of the instruction. Within the primary opcode, smaller encoding fields may be defined. These fields vary according to the class of operation being performed.

Almost all instructions that refer to a register and/or memory operand have a register and/or address mode byte following the opcode. This byte, the ModR/M byte, consists of the mod field (2 bits), the reg field (3 bits; this field is sometimes an opcode extension), and the R/M field (3 bits). Certain encodings of the ModR/M byte indicate that a second address mode byte, the SIB byte, must be used.

If the addressing mode specifies a displacement, the displacement value is placed immediately following the ModR/M byte or SIB byte. Possible sizes are 8, 16, or 32 bits. If the instruction specifies an immediate value, the immediate value follows any displacement bytes. The immediate, if specified, is always the last field of the instruction.

Special Fields

Table below lists bit fields that appear in certain instructions, sometimes within the opcode bytes.

Reg Field (reg) for Non-64-Bit Modes

The reg field in the ModR/M byte specifies a general-purpose register operand. The group of registers specified is modified by the presence and state of the w bit in an encoding (refer to Section B.1.4.3). Tables below show the encoding of the reg field when the w bit is not present in an encoding, and the encoding of the reg field when the w bit is present.

Reg Field (reg) for 64-Bit Mode

Just like in non-64-bit modes, the reg field in the ModR/M byte specifies a general-purpose register operand. The group of registers specified is modified by the presence of and state of the w bit in an encoding (refer to Section B.1.4.3). Tables below show the encoding of the reg field when the w bit is not present in an encoding, and the encoding of the reg field when the w bit is present.

Note:

• AH, CH, DH, BH can not be encoded when REX prefix is used. Such an expression defaults to the low byte.

Encoding of Operand Size (w) Bit

The current operand-size attribute determines whether the processor is performing 16-bit, 32-bit or 64-bit operations. Within the constraints of the current operand-size attribute, the operand-size bit (w) can be used to indicate operations on 8-bit operands or the full operand size specified with the operand-size attribute. Table below shows the encoding of the w bit depending on the current operand-size attribute.

Sign-Extend (s) Bit

The sign-extend (s) bit occurs in instructions with immediate data fields that are being extended from 8 bits to 16 or 32 bits.

Segment Register (sreg) Field

When an instruction operates on a segment register, the reg field in the ModR/M byte is called the sreg field and is used to specify the segment register. Table below shows the encoding of the sreg field. This field is sometimes a 2-bit field (sreg2) and other times a 3-bit field (sreg3).

Note:

• Do not use reserved encodings.

Special-Purpose Register (eee) Field

When control or debug registers are referenced in an instruction they are encoded in the eee field, located in bits 5 though 3 of the ModR/M byte (an alternate encoding of the sreg field).

Condition Test (tttn) Field

For conditional instructions (such as conditional jumps and set on condition), the condition test field (tttn) is encoded for the condition being tested. The ttt part of the field gives the condition to test and the n part indicates whether to use the condition (n = 0) or its negation (n = 1).

• For 1-byte primary opcodes, the tttn field is located in bits 3, 2, 1, and 0 of the opcode byte.
• For 2-byte primary opcodes, the tttn field is located in bits 3, 2, 1, and 0 of the second opcode byte.

Direction (d) Bit

In many two-operand instructions, a direction bit (d) indicates which operand is considered the source and which is the destination.

• When used for integer instructions, the d bit is located at bit 1 of a 1-byte primary opcode.
• When used for floating-point instructions (in Table B-16), the d bit is shown as bit 2 of the first byte of the primary opcode.

Other Notes

Table below contains notes on particular encodings.

A Cat Passed by Here AGAIN

    /\_____/\
   /  o   o  \
  ( ==  ^  == )
   )         (
  (           )
 ( (  )   (  ) )
(__(__)___(__)__)

OK LET'S GO ONE STEP DEEEEEEEEEPER

The Last Preface

• Date: 09/11/2023
• Reference: Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes - Volume 2 - Appendix B Instruction Formats and Encodings
• Link: Intel® 64 and IA-32 Architectures Software Developer Manuals

GENERAL-PURPOSE INSTRUCTION FORMATS AND ENCODINGS FOR NON-64-BIT MODES

Table below shows machine instruction formats and encodings for general purpose instructions in non-64-bit modes.

Notes:

• The multi-byte NOP instruction does not alter the content of the register and will not issue a memory operation.

General Purpose Instruction Formats and Encodings for 64-Bit Mode

Tables below show machine instruction formats and encodings for general purpose instructions in 64-bit mode.

Warning (Not FBI)

• This summary is for reference only and does not guarantee complete accuracy.